IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 15 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() The wrong goto label was used for the error case and missed cleanup of the pkt allocation. Addresses-Coverity-ID: 1493352 ("Resource leak")
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/1ced0a3015a95c6a6db45e37250912c4c86697ab
- https://git.kernel.org/stable/c/76b648063eb36c72dfc0a6896de8a0a7d2c7841c
- https://git.kernel.org/stable/c/d53456492b5d02033c73dfa0f3b94c86337791ba
- https://git.kernel.org/stable/c/0aaec9c5f60754b56f84460ea439b8c5e91f4caa
- https://git.kernel.org/stable/c/79dcbd8176152b860028b62f81a635d987365752
- https://git.kernel.org/stable/c/7cf6466e00a77b0a914b7b2c28a1fc7947d55e59
- https://git.kernel.org/stable/c/aefcc25f3a0cd28a87d11d41d30419a12cd26a34
- https://git.kernel.org/stable/c/bee90911e0138c76ee67458ac0d58b38a3190f65
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-33752
- GCVE · GCVE-0-2021-47104
CERT-FR advisories
- CERTFR-2024-AVI-0526 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0496 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0458 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0440 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0420 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0363 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0329 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.4.292 < 4.4.297cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.9.290 < 4.9.295cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.14.255 < 4.14.260cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.216 < 4.19.223cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.157 < 5.4.169cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.77 < 5.10.89cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15 < 5.15.12cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected bda41654b6e0c125a624ca35d6d20beb8015b5d0 < 1ced0a3015a95c6a6db45e37250912c4c86697ab ; affected 3f57c3f67fd93b4da86aeffea1ca32c484d054ad < 76b648063eb36c72dfc0a6896de8a0a7d2c7841c ; affected 60833707b968d5ae02a75edb7886dcd4a957cf0d < d53456492b5d02033c73dfa0f3b94c86337791ba ; affected 73d2892148aa4397a885b4f4afcfc5b27a325c42 < 0aaec9c5f60754b56f84460ea439b8c5e91f4caa ; affected 0f8cdfff06829a0b0348b6debc29ff6a61967724 < 79dcbd8176152b860028b62f81a635d987365752 ; affected c3e17e58f571f34c51aeb17274ed02c2ed5cf780 < 7cf6466e00a77b0a914b7b2c28a1fc7947d55e59 |
| Linux · Linux | affected 5.15 ; unaffected 0 < 5.15 ; unaffected 4.4.297 ≤ 4.4.* ; unaffected 4.9.295 ≤ 4.9.* ; unaffected 4.14.260 ≤ 4.14.* ; unaffected 4.19.223 ≤ 4.19.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |